Re: [exim-dev] Popping '.' from @INC

Pàgina inicial
Delete this message
Reply to this message
Autor: Heiko Schlittermann
Data:  
A: exim-dev
Assumpte: Re: [exim-dev] Popping '.' from @INC
Phil Pennock <pdp@???> (So 12 Feb 2017 12:30:48 CET):
> On 2017-02-12 at 11:30 +0100, Heiko Schlittermann wrote:
> > I saw, that '.' now gets pop()ed from @INC in various Perl scripts.
> >
> > Is there a special reason doing so? If we'd deal with security in mind,
> > we should use Perl's taint mode to make the scripts more secure.
>
> Root invokes these scripts, often for messing with queue analysis.
> Invoking them in /tmp is entirely reasonable. Other people can write to
> /tmp, so letting people have code be run as root because root invoked an
> Exim tool while in /tmp is poor form.


Yes. But '.' is the last in the @INC array.
So, if Perl looks for a module in '.', it already failed finding it in
all the other (system) locations.

If we remove '.' from the @INC array, we should care about other
positions too, not only the last position.

    BEGIN {
        @INC = grep { !/^[.]$/ } @INC
    }


But this prevents a developer from temporarly using '.' in the very
first position of @INC for testing purpose as in

    perl -Mlib='.' exigrep
or
    PERL5LIB='.' exigrep


But, as it's a developer, one can use

    PERL5LIB=$(pwd) exigrep



Conclusion: removing the DOT is appreciated, but, if doing so, it should
be done completly, shouldn't it?

> Taint mode deals with when the invoker's environment is not trusted.
> It's excellent for daemons, CGIs, network protocol clients, etc. It's
> less useful for CLI tools which don't talk to untrusted services. I'm
> not opposed to it I just don't see the point here.
>
> Taint mode doesn't really protect against @INC being stupid.


Taint mode removes any '.' from @INC, and lets Perl ignore
PERL{5,}LIB, and PERL5OPT. While allowing you to put it
back into @INC via

    perl -T -I. exigrep


    Best regards from Dresden/Germany
    Viele Grüße aus Dresden
    Heiko Schlittermann
-- 
 SCHLITTERMANN.de ---------------------------- internet & unix support -
 Heiko Schlittermann, Dipl.-Ing. (TU) - {fon,fax}: +49.351.802998{1,3} -
 gnupg encrypted messages are welcome --------------- key ID: F69376CE -
 ! key id 7CBF764A and 972EAC9F are revoked since 2015-01 ------------ -